Privacy Policy

Last updated: July 11, 2026

At Kevlar-4u ("we," "us," or "our"), we understand that privacy matters deeply to you. This Privacy Policy transparently explains what data we collect, how we use it, and how you can control your data.

Our core architectural principle: Your content never leaves your device. Read on for the details.

1. Our Privacy Promise

Before the detailed provisions, here are our core commitments:

  • ✅ Your content under review is never uploaded to our servers
  • ✅ Your audit results (risk reports, RST output) are never uploaded to our servers
  • ✅ Your LLM API Keys are never accessed or stored by us
  • ✅ Your conversations with AI clients never pass through our servers
  • ✅ We use no third-party trackers or advertising cookies
  • ✅ We never sell any of your data

2. Data We Explicitly Do NOT Collect

To eliminate any ambiguity, the following categories of data are absolutely never collected:

  • ❌ The text content you submit for audit
  • ❌ Content hashes of your submissions
  • ❌ Your audit results (blackAtoms, audit reports, persona outputs)
  • ❌ Your LLM API Keys or LLM response content
  • ❌ Your Focus Topics or strategy configuration content
  • ❌ Your third-party service credentials

Processing of the above data occurs entirely on your local device and never leaves your machine.

3. Data We Collect

We collect only the minimum dataset necessary to provide the Service:

3.1 Account Information

  • Email address: Used for account registration, login authentication, and important service notifications
  • Display name (optional): Used for account personalization

3.2 Device and Technical Data

  • Installation ID: Anonymous device identifier for associating licenses with devices
  • Session ID (ses_ prefix): Temporary strategy service session identifier
  • Kevlar Client Version: The CLI tool version you are using
  • Strategy Channel / Locale: Strategy distribution channel and language preference
  • Current Strategy Hash: Current strategy bundle version hash (used to determine whether updates are needed)

3.3 Payment Information

  • We do not store your credit card number or complete payment credentials
  • Payment processing is handled by Lemon Squeezy (international users) or WeChat Pay (China users)
  • We store only the subscription status returned by the payment platform (active/cancelled/expiry date) and transaction ID

3.4 Security Event Reporting (Optional)

When the CLI Tool detects a security anomaly, you may choose to report it. Reported data includes only:

  • Event type identifier
  • Error stack traces (pre-sanitized; no user content included)

Security event reports do not contain any user content, audit results, or API credentials.

3.5 Usage Statistics (Anonymized)

We may collect anonymized, aggregated usage data for service improvement:

  • API call counts and types (without parameter content)
  • Strategy bundle download frequency
  • Feature usage distribution

4. Data Processing and Storage

| Data Type | Storage Location | Retention Period | |-----------|-----------------|------------------| | Account info (email, name) | Upstash Redis (cloud) | Duration of account | | License information | Upstash Redis (cloud) | License validity period | | Session ID | Upstash Redis (cloud) | Auto-expires after session ends | | Installation ID | Upstash Redis (cloud) | Duration of account | | Sync Token / API Key | Upstash Redis (cloud) | Until user revocation | | Payment records | Upstash Redis (cloud) | As required by law | | User content | Local device | User-controlled | | Audit results | Local device | User-controlled | | Security event reports | Upstash Redis (cloud) | 90 days |

5. Cookies and Tracking

5.1 Cookies We Use

  • Session Cookie (next-auth): Used solely to maintain login state; expires when the browser is closed
  • This is a strictly necessary technical cookie that does not require your consent

5.2 Technologies We Do NOT Use

  • ❌ Third-party tracking cookies
  • ❌ Advertising cookies
  • ❌ Google Analytics or similar analytics tools
  • ❌ Social media tracking pixels
  • ❌ Fingerprinting techniques

6. Third-Party Services

We rely on the following third parties to provide the Service. We recommend reviewing their privacy policies as well:

| Service | Purpose | Data Involved | Privacy Policy | |---------|---------|--------------|----------------| | Vercel | Website hosting and API deployment | Access logs (IP, User-Agent) | vercel.com/legal/privacy-policy | | Upstash | Redis data storage | Account data, license data | upstash.com/privacy | | Lemon Squeezy | Payment processing (international) | Email, payment info | lemonsqueezy.com/privacy | | WeChat Pay | Payment processing (China) | Payment info | pay.weixin.qq.com | | Google OAuth | Login authentication (non-China) | Google account info | policies.google.com/privacy |

7. Your Rights

Under applicable data protection laws (including GDPR), you have the following rights:

  • Right of Access: You may request a copy of your personal data we store
  • Right to Rectification: You may update or correct inaccurate personal data
  • Right to Erasure: You may request deletion of your personal data (account deletion)
  • Right to Data Portability: You may request export of your personal data in a structured format
  • Right to Restrict Processing: You may restrict our processing of your data in certain circumstances

To exercise these rights, please contact us (see Section 10).

8. Data Security

We implement reasonable technical measures to protect your data:

  • All API communication is encrypted via HTTPS
  • API Keys are stored as hashes and are irreversibly obfuscated
  • Strategy bundles are integrity-verified using HMAC-SHA256 signatures
  • Upstash Redis connections use TLS encryption
  • Account passwords are stored using bcrypt hashing

9. Children's Privacy

The Service is not intended for children under 13 years of age. We do not knowingly collect personal data from children under 13. If you believe we may have inadvertently collected a child's data, please contact us immediately and we will promptly delete it.

10. Contact Us

  • Email: [TBD]

If you have questions about our Privacy Policy or need to exercise your data rights, please contact us at any time.

11. Policy Changes

We may update this Privacy Policy. Material changes will be notified through:

  • Announcement on the official website
  • Email notification to your registered email address

Continued use of the Service after such notice constitutes acceptance of the modified policy.

At Kevlar-4u, privacy is not an add-on feature — it is a core architectural principle.

Back to Home